@starci/hfs 5.0.4 → 5.0.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 5.0.6
+
+- Changed: Support sealed per-project quality-service credentials and preserve valid composite cache entries and reused spec records.
+
+- Fixed: Preserve generated-contract provenance in front-end tier and bounds checks.
+
+## 5.0.5
+
+- Changed: Govern each app-check linter, compiler, test discovery and coverage, contract emitter and boot child through the CLI execution port with actual worker limits and complete output capture. Preserve cache identities, closure, flush behavior and coverage thresholds. Record source-proven native Page body layouts with their contextual constraints.
+
 ## 5.0.4
 
 - Changed: Record the existing shared Page semantic role in the selected canonical Grammar component contract, so universal composition proof does not infer concrete API names or accept an app-controlled switch.

package/README.md

@@ -26,6 +26,7 @@ starci app slot <path> [--cwd <dir>] [--json]
 starci app emit [--cwd <dir>]
 starci app db drift [--db-url-env <NAME>] [--json] [--cwd <dir>]
 starci app secret init | <set|get|unset|rename|remove|materialize|list|verify|recipients|migrate|split|audit|server-key> --env <env> ... [--cwd <dir>]
+starci app ci secret set <NAME> [--from-custody] [--env <env>] [--repo <owner/name>] [--execute]
 ```
 
 `starci app add` writes every front-end unit, in either edition, already in the shape of the harness's `contexts/code/fe`
@@ -227,8 +228,9 @@ read until `migrate` moves it (`runtime/scripts/lib/sealed-member.mjs` names bot
 seals every named key in one sops write (`runtime/scripts/hfs/secret.mjs`): on a terminal it prompts `<KEY>: ` for each with
 masked input (one `*` per character; a paste, backspace, Enter, Ctrl+C to cancel with nothing written), redirected stdin gives
 one key its whole text or several one `KEY=value` line each, `--from-file KEY=path` reads a key byte for byte
-(`secret-prompt.mjs`), and `--generate <bytes>` makes a random value per key. It then declares the keys in the environment's
-`secrets:` of a compose environment (`declareKeys`, `secret-standard.mjs`) and names a swarm environment's to wire by hand.
+(`secret-prompt.mjs`), and `--generate <bytes>` makes a random value per key. Keys declared by exact service credential
+references stay with that consumer; other keys are declared in the environment's `secrets:` of a compose environment
+(`declareKeys`, `secret-standard.mjs`), while a swarm environment's are named to wire by hand.
 A member is sealed to its environment's rule of the managed `.sops.yaml`; `recipients --env <env> [--add|--remove <age1...|owner>]`
 rewrites that rule (`environmentRecipients`, `secret-init.mjs`), and `init` takes the owner's identity as the app's recipient.
 Re-sealing a member whose every key the set replaces needs no age identity; adding a key to one does, and the identity is found
@@ -244,6 +246,24 @@ except `get --reveal`.
 
 ## Sonar
 
+The product's `.starcistacks/application-stacks.yaml` holds its connection profile: provider, local/hosted mode, public
+URL and `projects` entries. Each stored username, password, private URL or token has a separate `credentials[]` reference
+to its actual sealed member and `key`; a private endpoint uses `host.fromCredential`. A project analysis reference has
+`project: <projects[].key>`, independently of its reference `id`. Operator/admin login keys live in a separate authority
+member and are never selected implicitly by analysis or CI. Change the declared connection profile when moving to a
+hosted/cloud server; usernames, passwords and tokens remain sealed.
+
+The CI execution copy is explicit: `services.sonar.ci.secrets: [{name: <CI_NAME>, credential: <analysis-id>}]`, with
+`ci.token: <CI_NAME>` and the name/scope declared in the top-level `ci.secrets`. Declare the exact product credential
+first, seal it with `starci app secret set --env <declared-env> <provider> <KEY>`, then run
+`starci app ci secret set <CI_NAME> --from-custody` to inspect the plan and add `--execute` to stream its selected value
+to the CI provider. A dry run decrypts no credential, reads no stdin and reaches no remote. Custody input uses terminal or
+closed/null stdin; a competing pipe/file channel, even empty, is refused without reading it. A private endpoint has its
+own explicit secret-copy link selected by `ci.hostVar`; public endpoint selectors read CI variables. The native local release opens
+the selected product token through the common SOPS identity loader in memory and passes it only to the scanner child.
+Missing, ambiguous, unopenable, wrong-project or runtime-granted custody is a failure, with no host/global fallback.
+Analysis never creates a project, replaces its history or rotates a token. OIDC Codecov keeps no synthetic token member.
+
 One mechanism for both sides: every finding of the canon is imported into Sonar, and the quality gate
 fails while any is open. Nothing is configured per app; the pieces are managed files (`starci app sync`) and this package.
 

package/cache/app-families.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CheckFinding } from '../runtime/scripts/hfs/check.mjs';
 import { type TestFamilyResult } from './test-family.mjs';
 import { type TypesFamilyResult, type TypesProgram } from './types-family.mjs';
@@ -6,24 +7,26 @@ import type { CheckSession } from './types.mjs';
 /** The tsc programs of the app: the back end and each front-end workspace, from the tracked tsconfigs. */
 export declare function programsOf(tracked: readonly string[]): TypesProgram[];
 /** `--types`: `tsc --noEmit` per workspace program through the app's TypeScript, reused by program key. */
-export declare function runTypesForApp(session: CheckSession, { repoRoot, tracked, env }: {
+export declare function runTypesForApp(session: CheckSession, { repoRoot, tracked, env, execute }: {
     repoRoot: string;
     tracked: readonly string[];
     env: NodeJS.ProcessEnv;
-}): {
+    execute?: HeavyNodeRun | undefined;
+}): Promise<{
     result: TypesFamilyResult;
     findings: CheckFinding[];
-};
+}>;
 /** `--test`: the unit specs of the back end through the app's own Jest, reused by closure key; the merged total is judged by `@starci/hfs` (the coverage proof). */
-export declare function runTestForApp(session: CheckSession, { repoRoot, tracked }: {
+export declare function runTestForApp(session: CheckSession, { repoRoot, tracked, execute }: {
     repoRoot: string;
     tracked: readonly string[];
+    execute?: HeavyNodeRun | undefined;
 }): Promise<{
     result: TestFamilyResult | null;
     findings: CheckFinding[];
 }>;
 /** `--test --full --shard i/n`: one shard of the full unit run in the shape the shard merge reads; nothing is recorded. */
-export declare function runTestShard(repoRoot: string, index: number, total: number): number;
+export declare function runTestShard(repoRoot: string, index: number, total: number, execute?: HeavyNodeRun): Promise<number>;
 /** `--sonar`: the Sonar and Codecov baselines and the predictions from the merged coverage records; they never pass or fail a run. */
 export declare function runSonarForApp(session: CheckSession, { repoRoot }: {
     repoRoot: string;

package/cache/app-families.mjs

@@ -5,7 +5,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { skillRoot } from '../runtime/engine/runtime-root.mjs';
 import { coverageFrom } from '../runtime/scripts/hfs/coverage-from.mjs';
 import { readWhy } from '../runtime/scripts/hfs/check.mjs';
@@ -30,11 +30,11 @@ export function programsOf(tracked) {
     return programs.sort((a, b) => (a.name < b.name ? -1 : 1));
 }
 /** `--types`: `tsc --noEmit` per workspace program through the app's TypeScript, reused by program key. */
-export function runTypesForApp(session, { repoRoot, tracked, env }) {
+export async function runTypesForApp(session, { repoRoot, tracked, env, execute }) {
     const programs = programsOf(tracked);
     const trackedSet = new Set(tracked);
-    const result = runTypesFamily({
-        session, programs, run: createTscRunner({ appRoot: repoRoot }), toolCacheDir: toolCacheDir(repoRoot, env),
+    const result = await runTypesFamily({
+        session, programs, run: createTscRunner({ appRoot: repoRoot, execute }), toolCacheDir: toolCacheDir(repoRoot, env),
         inputsOf: (program) => {
             const side = program.name.startsWith('be') ? 'be' : 'fe';
             const prefix = `${program.reads?.[0] ?? side}/`;
@@ -45,12 +45,12 @@ export function runTypesForApp(session, { repoRoot, tracked, env }) {
     return { result, findings: result.findings.map((found) => asFinding(found, 'TS_DIAGNOSTIC', 'error', 'tsc')) };
 }
 /** `--test`: the unit specs of the back end through the app's own Jest, reused by closure key; the merged total is judged by `@starci/hfs` (the coverage proof). */
-export async function runTestForApp(session, { repoRoot, tracked }) {
+export async function runTestForApp(session, { repoRoot, tracked, execute }) {
     if (!tracked.includes('be/package.json') && !tracked.some((file) => file.startsWith('be/')))
         return { result: null, findings: [] };
-    const jest = await createJestEnvironment({ appRoot: repoRoot, side: 'be' });
+    const jest = await createJestEnvironment({ appRoot: repoRoot, side: 'be', execute });
     let judged = [];
-    const result = runTestFamily({
+    const result = await runTestFamily({
         session, jest, side: 'be', merge: installedSpecMerge(repoRoot),
         judge: (lcovPath) => {
             const report = coverageFrom({ repoRoot, lcov: fs.readFileSync(lcovPath, 'utf8'), files: [...tracked] });
@@ -64,10 +64,12 @@ export async function runTestForApp(session, { repoRoot, tracked }) {
     return { result, findings };
 }
 /** `--test --full --shard i/n`: one shard of the full unit run in the shape the shard merge reads; nothing is recorded. */
-export function runTestShard(repoRoot, index, total) {
+export async function runTestShard(repoRoot, index, total, execute) {
     const shard = shardArgs(index, total);
     const jestBin = createRequire(path.join(repoRoot, 'be', 'package.json')).resolve('jest/bin/jest');
-    const run = spawnSync(process.execPath, [jestBin, ...shard.args], { cwd: path.join(repoRoot, 'be'), stdio: 'inherit', env: { ...process.env, ...shard.env } });
+    const run = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest shard ${index}/${total}`, args: [jestBin, ...shard.args], cwd: path.join(repoRoot, 'be'), env: { ...process.env, ...shard.env }, maxBuffer: 256 * 1024 * 1024 }), 'jest shard');
+    process.stdout.write(run.stdout);
+    process.stderr.write(run.stderr);
     return run.status ?? 1;
 }
 /** `--sonar`: the Sonar and Codecov baselines and the predictions from the merged coverage records; they never pass or fail a run. */

package/cache/hfs-family.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type MachineFn, type RepositoryResult } from '../runtime/scripts/hfs/check.mjs';
 import type { Presets } from '../sync/index.mjs';
 import type { CheckSession, FamilyReport } from './types.mjs';
@@ -20,6 +21,7 @@ export interface PassResult {
 }
 export interface PassInput {
     readonly repoRoot: string;
+    readonly execute?: HeavyNodeRun | undefined;
     readonly harness?: {
         version?: string;
     } | undefined;

package/cache/hfs-family.mjs

@@ -7,9 +7,9 @@ import { checkRepo, checkRepository, trackedFiles } from '../runtime/scripts/hfs
 import { checkArchitecture } from '../runtime/scripts/hfs/architecture/index.mjs';
 import { withoutBootProof } from '../runtime/scripts/hfs/rules/boot-proof.mjs';
 import { withUnusedSymbolMemo } from '../runtime/scripts/hfs/rules/unused-symbol.mjs';
-import { contractEmitFindings } from '../runtime/scripts/hfs/rules/contract.mjs';
+import { contractEmitFindingsAsync } from '../runtime/scripts/hfs/rules/contract.mjs';
 import { loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
-import { emitContracts } from '../emit/contracts.mjs';
+import { emitContractsAsync } from '../emit/contracts.mjs';
 import { summarize } from '../runtime/scripts/hfs/check-results.mjs';
 import { managedFindings } from '../sync/managed.mjs';
 import { RecordSet, scopedStep } from './records.mjs';
@@ -61,9 +61,9 @@ export async function runStructurePass(session, input) {
         const key = keys.get('be');
         const emit = await scopedStep(session, records, {
             path: 'be', step: 'contract-emit', key: key?.key ?? 'none', reuse, inputs: key?.inputs ?? [],
-            compute: () => {
+            compute: async () => {
                 const files = tracked.filter((file) => file.startsWith(bePrefix)).map((file) => file.slice(bePrefix.length));
-                const emitted = contractEmitFindings({ repoRoot: path.join(repoRoot, 'be'), files, repo: be, emit: emitContracts });
+                const emitted = await contractEmitFindingsAsync({ repoRoot: path.join(repoRoot, 'be'), files, repo: be, emit: (request) => emitContractsAsync({ ...request, execute: input.execute }) });
                 return JSON.parse(JSON.stringify({ findings: emitted.findings, apps: emitted.apps }));
             },
             compact: (value) => (value.findings).map(compact),

package/cache/run.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CheckFinding, type RepositoryResult } from '../runtime/scripts/hfs/check.mjs';
 import type { Presets } from '../sync/index.mjs';
 import type { Prettier } from '../sync/format.mjs';
@@ -6,6 +7,7 @@ import { type CheckSession, type FamilyId, type FamilyReport } from './types.mjs
 export declare const DEFAULT_FAMILIES: readonly FamilyId[];
 export interface AppRunInput {
     readonly repoRoot: string;
+    readonly execute?: HeavyNodeRun | undefined;
     readonly tracked: readonly string[];
     readonly session: CheckSession;
     readonly selected: ReadonlySet<FamilyId>;

package/cache/run.mjs

@@ -1,6 +1,3 @@
-// run.mts - one `starci app check` / `starci app lint` pass over the selected families, against one session. It owns the order of the families,
-// the judging of their findings (edition and the Vietnamese why of every code) and the merge into the one result the verb prints and the gate
-// judges, so the two verbs never hold two answers for one tree.
 import { skillRoot } from '../runtime/engine/runtime-root.mjs';
 import { readWhy } from '../runtime/scripts/hfs/check.mjs';
 import { judgedFindings, summarize, withWhy } from '../runtime/scripts/hfs/check-results.mjs';
@@ -23,7 +20,7 @@ export async function runAppFamilies(input) {
     const track = (report) => void (report && reports.push(report));
     const structure = selected.has('hfs') || selected.has('secrets');
     const pass = structure
-        ? await runStructurePass(session, { repoRoot, harness: input.harness, presets: input.presets, tracked: input.tracked, hfs: selected.has('hfs'), secrets: selected.has('secrets') })
+        ? await runStructurePass(session, { repoRoot, harness: input.harness, presets: input.presets, tracked: input.tracked, hfs: selected.has('hfs'), secrets: selected.has('secrets'), execute: input.execute })
         : null;
     if (pass) {
         track(pass.report);
@@ -43,7 +40,7 @@ export async function runAppFamilies(input) {
     }
     let wiring;
     if (selected.has('wiring')) {
-        const proved = await runWiringFamily(session, { repoRoot, edition: input.edition, files: input.tracked });
+        const proved = await runWiringFamily(session, { repoRoot, edition: input.edition, files: input.tracked, execute: input.execute });
         track(proved.report);
         wiring = { status: proved.wiring.status, apps: proved.wiring.apps, findings: proved.wiring.findings };
         extra.push(...proved.wiring.findings);

package/cache/session.mjs

@@ -137,7 +137,7 @@ export function createDiskSession(options) {
             // A file edited while the run read it gets no record.
             const settled = new Map();
             for (const [folder, { records }] of replaced) {
-                settled.set(folder, records.filter((record) => index.hashOf(record.path) === undefined || hashFile(path.join(root, record.path)) === record.hash));
+                settled.set(folder, records.filter((record) => index.hashOf(record.path) === undefined || hashFile(path.join(root, record.path)) === index.hashOf(record.path)));
             }
             if (trust.kind === 'base') {
                 const committed = new Map();

package/cache/test-family.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import type { CacheRecord, CheckSession, FamilyReport, JsonValue } from './types.mjs';
 /** The folder of the session that holds the records of this family. */
 export declare const TEST_FOLDER = "test-coverage";
@@ -33,7 +34,7 @@ export interface JestEnvironment {
     /** The digest of the unit project's configuration, free of host paths. */
     readonly configHash: string;
     /** Runs `specs` (all of them when `specs` is every spec) writing the per-spec coverage into `coverageDir`. */
-    run(specs: readonly string[], coverageDir: string): RunOutcome;
+    run(specs: readonly string[], coverageDir: string): RunOutcome | Promise<RunOutcome>;
     /** Reads what the reporter wrote into `coverageDir`. */
     readCoverage(coverageDir: string): readonly SpecCoverageOutput[];
 }
@@ -67,7 +68,7 @@ export interface TestFamilyResult {
     readonly ok: boolean;
     readonly ran: readonly string[];
     readonly reused: readonly string[];
-    /** Specs that failed or did not report: nothing of theirs is stored. */
+    /** Specs that failed, did not report, or whose inputs changed: nothing of theirs is stored. */
     readonly failed: readonly string[];
     /** The merged lcov, or undefined when no spec has a record. */
     readonly lcov: string | undefined;
@@ -94,7 +95,7 @@ export declare function sourcesOf(record: CacheRecord): Record<string, SourceIte
  * Runs the unit specs against the cache. Diff mode runs the specs with no current record, full mode all of them; a passing spec's coverage is stored under its key,
  * a failing one's is not, and the folder is replaced with exactly the current specs' records. The merged total is written to `<side>/coverage/lcov.info` and judged.
  */
-export declare function runTestFamily(options: TestFamilyOptions): TestFamilyResult;
+export declare function runTestFamily(options: TestFamilyOptions): Promise<TestFamilyResult>;
 /** The part of a Jest project config the closure needs. */
 interface ProjectConfigLike {
     readonly rootDir: string;
@@ -111,11 +112,12 @@ export declare function projectConfigHash(config: ProjectConfigLike): string;
  * The app's own Jest, resolved from `jestFrom` (a package.json or folder inside the app's install): its unit project's configuration, its haste map and resolver
  * (so `moduleNameMapper`, `jest.mock` targets and setup files count as Jest sees them), and its binary to run specs. `side` is the Jest root, app-relative.
  */
-export declare function createJestEnvironment({ appRoot, side, jestFrom, project }: {
+export declare function createJestEnvironment({ appRoot, side, jestFrom, project, execute }: {
     appRoot: string;
     side: string;
     jestFrom?: string;
     project?: string;
+    execute?: HeavyNodeRun | undefined;
 }): Promise<JestEnvironment>;
 /** The installed preset's union merge (resolved like the shard merge of `app coverage`): the records in, the lcov and coverage-final.json out. */
 export declare function installedSpecMerge(appRoot: string, from?: string): MergeSpecRecords;

package/cache/test-family.mjs

@@ -8,7 +8,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { combineHashes, hashFile } from './hash.mjs';
 import { canonicalJson } from './jsonl.mjs';
 /** The folder of the session that holds the records of this family. */
@@ -57,7 +57,7 @@ function recordOf(spec, key, sources, side) {
  * Runs the unit specs against the cache. Diff mode runs the specs with no current record, full mode all of them; a passing spec's coverage is stored under its key,
  * a failing one's is not, and the folder is replaced with exactly the current specs' records. The merged total is written to `<side>/coverage/lcov.info` and judged.
  */
-export function runTestFamily(options) {
+export async function runTestFamily(options) {
     const { session, jest, side, merge, judge } = options;
     const decision = session.decide('test');
     const hashOf = (file) => session.index.hashOf(file) ?? hashFile(path.join(session.root, file));
@@ -79,13 +79,12 @@ export function runTestFamily(options) {
         try {
             fs.rmSync(scratch, { recursive: true, force: true });
             fs.mkdirSync(scratch, { recursive: true });
-            output = jest.run(toRun, scratch).output;
+            output = (await jest.run(toRun, scratch)).output;
             const reported = new Map(jest.readCoverage(scratch).map((file) => [file.spec, file]));
             for (const spec of toRun) {
                 const file = reported.get(posix(path.relative(path.join(session.root, side), path.join(session.root, spec))));
-                const key = specKey({ spec, closure: jest.closureOf(spec), configHash: jest.configHash, hashOf });
-                // A spec that failed, did not report, or whose files changed while it ran stores nothing.
-                if (file?.passed === true && key === keys.get(spec))
+                const key = keys.get(spec);
+                if (file?.passed === true && key !== undefined)
                     fresh.push(recordOf(spec, key, file.sources, side));
                 else
                     failed.push(spec);
@@ -96,9 +95,18 @@ export function runTestFamily(options) {
                 fs.rmSync(scratch, { recursive: true, force: true });
         }
     }
-    progress.tick(jest.specs.length, kept.length, toRun.length);
+    // Recheck every candidate against disk, including a reused spec whose inputs another running spec could change.
+    const records = [...kept, ...fresh].filter((record) => {
+        const key = specKey({ spec: record.path, closure: jest.closureOf(record.path), configHash: jest.configHash, hashOf: (file) => hashFile(path.join(session.root, file)) });
+        if (key === keys.get(record.path))
+            return true;
+        failed.push(record.path);
+        return false;
+    });
+    const settled = new Set(records.map((record) => record.path));
+    const reused = kept.filter((record) => settled.has(record.path));
+    progress.tick(jest.specs.length, reused.length, toRun.length);
     progress.end();
-    const records = [...kept, ...fresh];
     session.replace(TEST_FOLDER, records);
     let lcov;
     let threshold;
@@ -117,13 +125,13 @@ export function runTestFamily(options) {
         mode: decision.mode,
         reason: decision.reason,
         checked: toRun.length,
-        reused: kept.length,
+        reused: reused.length,
         newFindings: failed.length + thresholdFindings,
         knownFindings: 0,
         fixedFindings: 0,
     };
     session.report(report);
-    return { ok: failed.length === 0 && (threshold?.ok ?? records.length === 0), ran: toRun, reused: kept.map((record) => record.path), failed, lcov, threshold, report, output };
+    return { ok: failed.length === 0 && (threshold?.ok ?? records.length === 0), ran: toRun, reused: reused.map((record) => record.path), failed, lcov, threshold, report, output };
 }
 /** The digest of a project config with host paths turned into `<root>` and the keys that differ per host dropped. */
 export function projectConfigHash(config) {
@@ -144,7 +152,7 @@ export function projectConfigHash(config) {
  * The app's own Jest, resolved from `jestFrom` (a package.json or folder inside the app's install): its unit project's configuration, its haste map and resolver
  * (so `moduleNameMapper`, `jest.mock` targets and setup files count as Jest sees them), and its binary to run specs. `side` is the Jest root, app-relative.
  */
-export async function createJestEnvironment({ appRoot, side, jestFrom, project = 'unit' }) {
+export async function createJestEnvironment({ appRoot, side, jestFrom, project = 'unit', execute }) {
     const root = path.resolve(appRoot, side);
     const fromApp = createRequire(jestFrom ?? path.join(root, 'package.json'));
     const jestPackage = fromApp.resolve('jest/package.json');
@@ -189,7 +197,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
     const relative = (file) => posix(path.relative(appRoot, file));
     const setup = (name) => [...(config[name] ?? [])];
     const setupClosure = closureFrom([...setup('setupFiles'), ...setup('setupFilesAfterEnv')]).map(relative);
-    const listed = spawnSync(process.execPath, [jestBin, '--selectProjects', project, '--listTests'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    const listed = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest ${project} discovery`, args: [jestBin, '--selectProjects', project, '--listTests'], cwd: root, maxBuffer: 64 * 1024 * 1024 }), 'jest discovery');
     if (listed.status !== 0)
         throw new Error(`jest --listTests failed under ${side}: ${(listed.stderr || listed.stdout).split('\n')[0]}`);
     const specs = listed.stdout.split(/\r?\n/u).map((line) => line.trim()).filter((line) => path.isAbsolute(line)).map((line) => relative(path.resolve(line))).sort();
@@ -206,7 +214,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
             closures.set(spec, closure);
             return closure;
         },
-        run(toRun, coverageDir) {
+        async run(toRun, coverageDir) {
             const base = [jestBin, '--selectProjects', project, '--coverage', '--ci'];
             const everything = toRun.length === specs.length;
             const sideRelative = toRun.map((spec) => posix(path.relative(root, path.resolve(appRoot, spec))));
@@ -223,7 +231,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
             let output = '';
             for (const chunk of chunks) {
                 const args = chunk.length > 0 ? [...base, '--runTestsByPath', ...chunk] : base;
-                const result = spawnSync(process.execPath, args, { cwd: root, encoding: 'utf8', env: { ...process.env, STARCI_SPEC_COVERAGE_DIR: coverageDir }, maxBuffer: 256 * 1024 * 1024 });
+                const result = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest ${project} coverage`, args, cwd: root, env: { ...process.env, STARCI_SPEC_COVERAGE_DIR: coverageDir }, maxBuffer: 256 * 1024 * 1024 }), 'jest coverage');
                 status = status || (result.status ?? 1);
                 output += `${result.stdout}${result.stderr}`;
             }

package/cache/types-family.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import type { CheckSession, FamilyReport, Finding } from './types.mjs';
 /** The folder of the session that holds the records of this family. */
 export declare const TYPES_FOLDER = "check/types";
@@ -29,7 +30,7 @@ export interface TypesFamilyOptions {
     readonly session: CheckSession;
     readonly programs: readonly TypesProgram[];
     /** Runs one program's `tsc`; `buildInfo` is where its `.tsbuildinfo` goes (the untracked tool cache). */
-    readonly run: (program: TypesProgram, buildInfo: string) => TscOutcome;
+    readonly run: (program: TypesProgram, buildInfo: string) => TscOutcome | Promise<TscOutcome>;
     /** The untracked tool cache of slot `app.tool-cache` (`<STARCI_CACHE_HOME>/<repo>/app-check`). */
     readonly toolCacheDir: string;
     readonly inputsOf?: (program: TypesProgram) => ProgramInputs;
@@ -63,12 +64,13 @@ export declare function parseTscOutput(output: string, appRoot: string, fallback
  * Runs the type check of every program against the cache. A program whose key is unchanged takes its recorded diagnostics; a changed one runs in full (all of them
  * under `--full`). A run that produced no diagnostics and failed (tsc itself could not complete) stores nothing, and so does a program whose files changed while it ran.
  */
-export declare function runTypesFamily(options: TypesFamilyOptions): TypesFamilyResult;
+export declare function runTypesFamily(options: TypesFamilyOptions): Promise<TypesFamilyResult>;
 /**
  * The real `tsc` of an app: the program's own TypeScript (resolved from its folder, so the version the lockfile pins), `--noEmit` with an incremental build info in the
  * tool cache, run from the app root so paths in the output are app-relative.
  */
-export declare function createTscRunner({ appRoot, typescriptFrom }: {
+export declare function createTscRunner({ appRoot, typescriptFrom, execute }: {
     appRoot: string;
     typescriptFrom?: string;
+    execute?: HeavyNodeRun | undefined;
 }): TypesFamilyOptions['run'];

package/cache/types-family.mjs

@@ -6,7 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { CACHE_DIR } from './types.mjs';
 import { combineHashes, hashFile } from './hash.mjs';
 import { sortFindings } from './jsonl.mjs';
@@ -84,7 +84,7 @@ const identity = (finding) => `${finding.path}\0${finding.rule}\0${finding.messa
  * Runs the type check of every program against the cache. A program whose key is unchanged takes its recorded diagnostics; a changed one runs in full (all of them
  * under `--full`). A run that produced no diagnostics and failed (tsc itself could not complete) stores nothing, and so does a program whose files changed while it ran.
  */
-export function runTypesFamily(options) {
+export async function runTypesFamily(options) {
     const { session, programs, run, toolCacheDir } = options;
     const decision = session.decide('types');
     const previous = new Map(session.records(TYPES_FOLDER).filter((record) => record.step === TSC_STEP).map((record) => [record.path, record]));
@@ -108,7 +108,7 @@ export function runTypesFamily(options) {
             reused.push(program.name);
         }
         else {
-            const outcome = run(program, tsBuildInfoPath(toolCacheDir, session.root, program));
+            const outcome = await run(program, tsBuildInfoPath(toolCacheDir, session.root, program));
             ran.push(program.name);
             current = parseTscOutput(outcome.output, session.root, program.tsconfig);
             if (current.length === 0 && outcome.status !== 0)
@@ -141,14 +141,15 @@ export function runTypesFamily(options) {
  * The real `tsc` of an app: the program's own TypeScript (resolved from its folder, so the version the lockfile pins), `--noEmit` with an incremental build info in the
  * tool cache, run from the app root so paths in the output are app-relative.
  */
-export function createTscRunner({ appRoot, typescriptFrom }) {
-    return (program, buildInfo) => {
+export function createTscRunner({ appRoot, typescriptFrom, execute }) {
+    return async (program, buildInfo) => {
         const folder = path.resolve(appRoot, path.posix.dirname(program.tsconfig));
         const tsc = path.join(path.dirname(createRequire(typescriptFrom ?? path.join(folder, 'package.json')).resolve('typescript/package.json')), 'bin', 'tsc');
         fs.mkdirSync(path.dirname(buildInfo), { recursive: true });
-        const result = spawnSync(process.execPath, [tsc, '-p', posix(path.relative(appRoot, path.resolve(appRoot, program.tsconfig))), '--noEmit', '--incremental', '--tsBuildInfoFile', buildInfo, '--pretty', 'false'], {
-            cwd: appRoot, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024,
-        });
+        const result = completedNode(await runHeavyNode(execute, {
+            kind: 'tsc', label: `app check tsc ${program.name}`, args: [tsc, '-p', posix(path.relative(appRoot, path.resolve(appRoot, program.tsconfig))), '--noEmit', '--incremental', '--tsBuildInfoFile', buildInfo, '--pretty', 'false'],
+            cwd: appRoot, maxBuffer: 256 * 1024 * 1024,
+        }), 'tsc');
         return { status: result.status ?? 1, output: `${result.stdout}${result.stderr}` };
     };
 }

package/cache/wiring-family.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type WiringResult } from '../runtime/scripts/hfs/app-wiring.mjs';
 import type { CheckSession, FamilyReport } from './types.mjs';
 export declare const WIRING_FOLDER = "check/wiring";
@@ -6,9 +7,10 @@ export interface WiringFamilyResult {
     readonly report: FamilyReport;
 }
 /** The boot proof family. `explicit` is the whole-tree proof of `--wiring`; without it a missing install leaves the compile unjudged, as the content finder does. */
-export declare function runWiringFamily(session: CheckSession, { repoRoot, edition, files, run }: {
+export declare function runWiringFamily(session: CheckSession, { repoRoot, edition, files, run, execute }: {
     repoRoot: string;
     edition?: string | undefined;
     files?: readonly string[] | undefined;
-    run?: ((repoRoot: string) => WiringResult) | undefined;
+    run?: ((repoRoot: string) => WiringResult | Promise<WiringResult>) | undefined;
+    execute?: HeavyNodeRun | undefined;
 }): Promise<WiringFamilyResult>;

package/cache/wiring-family.mjs

@@ -2,7 +2,7 @@
 // back-end side key is unchanged. A timeout reached no verdict and is never stored.
 import fs from 'node:fs';
 import path from 'node:path';
-import { appWiring, BOOT_PROOF_TIMEOUT } from '../runtime/scripts/hfs/app-wiring.mjs';
+import { appWiringAsync, BOOT_PROOF_TIMEOUT } from '../runtime/scripts/hfs/app-wiring.mjs';
 import { loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { trackedFiles } from '../runtime/scripts/hfs/check.mjs';
 import { RecordSet, scopedStep } from './records.mjs';
@@ -11,16 +11,16 @@ import { sideKey } from './side-key.mjs';
 export const WIRING_FOLDER = 'check/wiring';
 const compact = (finding) => ({ path: finding.path, line: 0, column: 0, rule: finding.code, message: finding.message });
 /** The boot proof family. `explicit` is the whole-tree proof of `--wiring`; without it a missing install leaves the compile unjudged, as the content finder does. */
-export async function runWiringFamily(session, { repoRoot, edition, files, run }) {
+export async function runWiringFamily(session, { repoRoot, edition, files, run, execute }) {
     const decision = session.decide('wiring');
     const records = new RecordSet(session.records(WIRING_FOLDER));
     const key = sideKey(repoRoot, session.index, 'be');
-    const prove = () => {
+    const prove = async () => {
         if (run)
             return run(repoRoot);
         const declared = readRepoDeclaration(loadSlotManifest(), repoRoot);
         const repo = { ...declared, edition: edition ?? declared.edition };
-        const proof = appWiring({ repoRoot, repo: repo, files: [...(files ?? trackedFiles(repoRoot))] });
+        const proof = await appWiringAsync({ repoRoot, repo: repo, files: [...(files ?? trackedFiles(repoRoot))], execute });
         const installed = fs.existsSync(path.join(repoRoot, 'node_modules')) || fs.existsSync(path.join(repoRoot, 'be', 'node_modules'));
         const findings = proof.findings.filter((finding) => installed || finding.reason !== 'module or proof could not be compiled');
         return { ...proof, findings, ok: findings.length === 0 };
@@ -28,7 +28,7 @@ export async function runWiringFamily(session, { repoRoot, edition, files, run }
     const step = session.progress.step('wiring', 'boot proof', Math.max(1, key.inputs.length));
     const { value, reused } = await scopedStep(session, records, {
         path: 'be', step: 'boot-proof', key: key.key, reuse: decision.mode === 'diff', inputs: key.inputs,
-        compute: () => JSON.parse(JSON.stringify(prove())),
+        compute: async () => JSON.parse(JSON.stringify(await prove())),
         compact: (found) => found.findings.map(compact),
         store: (found) => !found.findings.some((finding) => finding.code === BOOT_PROOF_TIMEOUT),
     });

package/ci/cli.d.mts

@@ -1,9 +1,11 @@
+import { type SecretSops } from '../runtime/scripts/hfs/secret-sops.mjs';
+import type { AgeHost } from '../runtime/scripts/hfs/secret-init.mjs';
 import type { GhSpawn, StdinSource } from './github.mjs';
 /** The commands of `starci app ci` (besides `local`) with the options each takes; the parser refuses every other. */
 export declare const COMMANDS: Record<string, string[]>;
 export declare const BOOLEAN: Set<string>;
 /** Manifest and sealed key reads remain offline; only github.mjs may invoke the GitHub CLI. */
-export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env, tools }?: {
+export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env, tools, hostIdentity, sops, platform, inputRedirected }?: {
     cwd?: string | undefined;
     stdout?: ((text: string) => unknown) | undefined;
     stderr?: ((text: string) => unknown) | undefined;
@@ -12,4 +14,8 @@ export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env
     tools?: {
         spawn?: GhSpawn | undefined;
     } | undefined;
+    hostIdentity?: AgeHost | null | undefined;
+    sops?: Pick<SecretSops, 'decrypt'> | null | undefined;
+    platform?: NodeJS.Platform | undefined;
+    inputRedirected?: (() => boolean) | undefined;
 }): Promise<number>;